setup_lru_func setup_lru,
enum AVPixelFormat fmt)
{
- GetByteContext gb;
+ GetByteContext gb, gb_check;
GetBitContext gb2;
int nslices, slice, line = 0;
uint32_t off, slice_size;
+ uint64_t off_check;
uint8_t lru[3][8];
int ret;
if (ret < 0)
return ret;
+ off_check = off;
+ gb_check = gb;
+ for (slice = 0; slice < nslices; slice++) {
+ slice_size = bytestream2_get_le32(&gb_check);
+
+ if (slice_size <= 16 + (avctx->height * avctx->width / (8 * nslices)))
+ return AVERROR_INVALIDDATA;
+ off_check += slice_size;
+ }
+
+ if (off_check - avctx->discard_damaged_percentage*off_check/100 > src_size)
+ return AVERROR_INVALIDDATA;
+
avctx->pix_fmt = fmt;
if ((ret = ff_get_buffer(avctx, pic, 0)) < 0)
return ret;
}
if (avctx->height - line) {
- av_log(avctx, AV_LOG_VERBOSE,
- "Not enough slice data available, "
- "cropping the frame by %d pixels\n",
- avctx->height - line);
- avctx->height = line;
+ avpriv_request_sample(avctx, "Not enough slice data available");
}
return 0;
int stride = frame->linesize[0];
uint8_t *dst = frame->data[0] + stride * line;
- for (y = 0; y < left && get_bits_left(gb) > 16; y++) {
+ for (y = 0; y < left && get_bits_left(gb) > 6 * width; y++) {
for (x = 0; x < width; x++) {
b = decode_sym_565(gb, lru[0], 5);
g = decode_sym_565(gb, lru[1], is_565 ? 6 : 5);
int stride = frame->linesize[0];
uint8_t *dst = frame->data[0] + stride * line;
- for (y = 0; y < left && get_bits_left(gb) > 16; y++) {
+ for (y = 0; y < left && get_bits_left(gb) > 6 * width; y++) {
for (x = 0; x < width; x++) {
dst[x * 3 + 0] = decode_sym(gb, lru[0]);
dst[x * 3 + 1] = decode_sym(gb, lru[1]);
uint8_t *U = frame->data[1] + (ustride >> 2) * line;
uint8_t *V = frame->data[2] + (vstride >> 2) * line;
- for (y = 0; y < left - 3 && get_bits_left(gb) > 16; y += 4) {
+ for (y = 0; y < left - 3 && get_bits_left(gb) > 9 * width; y += 4) {
for (x = 0; x < width; x += 4) {
for (j = 0; j < 4; j++)
for (i = 0; i < 4; i++)
uint8_t *V = frame->data[2] + (vstride >> 1) * line;
- for (y = 0; y < left - 1 && get_bits_left(gb) > 16; y += 2) {
+ for (y = 0; y < left - 1 && get_bits_left(gb) > 6 * width; y += 2) {
for (x = 0; x < width; x += 2) {
Y[x + 0 + 0 * ystride] = decode_sym(gb, lru[0]);
Y[x + 1 + 0 * ystride] = decode_sym(gb, lru[0]);
uint8_t *U = frame->data[1] + ustride * line;
uint8_t *V = frame->data[2] + vstride * line;
- for (y = 0; y < left && get_bits_left(gb) > 16; y++) {
+ for (y = 0; y < left && get_bits_left(gb) > 6 * width; y++) {
for (x = 0; x < width; x++) {
Y[x] = decode_sym(gb, lru[0]);
U[x] = decode_sym(gb, lru[1]) ^ 0x80;